chore(deps): update module github.com/go-jose/go-jose/v4 to v4.0.5 [security] (release-2.14)

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
github.com/go-jose/go-jose/v4	v4.0.1 -> v4.0.5

---

DoS in go-jose Parsing in github.com/go-jose/go-jose

CVE-2025-27144 / GHSA-c6gw-w398-hv78 / GO-2025-3485

More information

Details

DoS in go-jose Parsing in github.com/go-jose/go-jose

Severity

Unknown

References

• https://github.com/go-jose/go-jose/security/advisories/GHSA-c6gw-w398-hv78
• https://github.com/go-jose/go-jose/commit/99b346cec4e86d102284642c5dcbe9bb0cacfc22
• https://github.com/go-jose/go-jose/releases/tag/v4.0.5
• https://go.dev/issue/71490

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

DoS in go-jose Parsing

CVE-2025-27144 / GHSA-c6gw-w398-hv78 / GO-2025-3485

More information

Details

Impact

When parsing compact JWS or JWE input, go-jose could use excessive memory. The code used strings.Split(token, ".") to split JWT tokens, which is vulnerable to excessive memory consumption when processing maliciously crafted tokens with a large number of '.' characters. An attacker could exploit this by sending numerous malformed tokens, leading to memory exhaustion and a Denial of Service.

Patches

Version 4.0.5 fixes this issue

Workarounds

Applications could pre-validate payloads passed to go-jose do not contain an excessive number of '.' characters.

References

This is the same sort of issue as in the golang.org/x/oauth2/jws package as CVE-2025-22868 and Go issue https://go.dev/issue/71490.

Severity

• CVSS Score: Unknown
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

• https://github.com/go-jose/go-jose/security/advisories/GHSA-c6gw-w398-hv78
• https://nvd.nist.gov/vuln/detail/CVE-2025-27144
• https://github.com/golang/go/issues/71490
• https://github.com/go-jose/go-jose/commit/99b346cec4e86d102284642c5dcbe9bb0cacfc22
• https://github.com/go-jose/go-jose
• https://github.com/go-jose/go-jose/releases/tag/v4.0.5
• https://go.dev/issue/71490

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

go-jose/go-jose (github.com/go-jose/go-jose/v4)

v4.0.5

Compare Source

What's Changed

• Don't allow unbounded amounts of splits by @​mcpherrinm in https://github.com/go-jose/go-jose/pull/167

Fixes GHSA-c6gw-w398-hv78

Various other dependency updates, small fixes, and documentation updates in the full changelog

New Contributors

• @​tgeoghegan made their first contribution in https://github.com/go-jose/go-jose/pull/161

Full Changelog: go-jose/go-jose@v4.0.4...v4.0.5

v4.0.4

Compare Source

Fixed

• Reverted "Allow unmarshalling JSONWebKeySets with unsupported key types" as a
  breaking change. See #​136 / #​137.

v4.0.3

Compare Source

Changed

• Allow unmarshalling JSONWebKeySets with unsupported key types (#​130)
• Document that OpaqueKeyEncrypter can't be implemented (for now) (#​129)
• Dependency updates

v4.0.2

Compare Source

Changed

• Improved documentation of Verify() to note that JSONWebKeySet is a supported
  argument type (#​104)
• Defined exported error values for missing x5c header and unsupported elliptic
  curves error cases (#​117)

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 3 additional dependencies were updated

Details:

Package	Change
github.com/stretchr/testify	v1.9.0 -> v1.10.0
golang.org/x/crypto	v0.31.0 -> v0.32.0
golang.org/x/sys	v0.28.0 -> v0.29.0